CVE-2026-16762: Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
Other sources
Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
azurelinux/qtbaseto a version that resolves this vulnerability.Fixed in 6.6.3-8
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications that use QXmlStreamReader to parse XML influenced by an attacker are exposed. The denial of service is limited to the affected application process.
What does an attacker need to exploit it?
An attacker only needs to provide a crafted XML document that the application parses with QXmlStreamReader. No authentication, privileges, or user interaction beyond the application ingesting that input are required.
What is the impact of successful exploitation?
Successful exploitation can cause disproportionate CPU consumption while parsing XML, making the application unresponsive. The provided information indicates no confidentiality or integrity impact, code execution, data disclosure, or data modification.